IBM X-Force report details a dramatic increase in financial services cyber attacks and records breaches. IT security experts from CipherCloud, Cyphort, Inc., Cyphort Labs, NuData Security and Prevoty commented below. Pravin Kothari, Founder, Chairman & CEO at CipherCloud: “The new IBM X Force report once again demonstrates the escalating threat of data breaches that every organization is now facing, and underscores that the financial services industry is essentially under siege from bad actors. At the same time, financial services applications are increasingly in the cloud, outside of the organization’s direct visibility and control, and beyond the reach of firewalls and other legacy cybersecurity defenses. Organizations must fully embrace a data-centric security model, including persistent encryption…
ISBuzz Team
Imperva Survey Shows Most IT Security Professionals are Aware of GDPR, Yet Only 43 Percent of Organizations are Preparing London, UK. Imperva, Inc. (NASDAQ: IMPV), committed to protecting business-critical data and applications in the cloud and on-premises, today announced the results of a survey on the current state of company preparedness for the European General Data Protection Regulation (GDPR). The survey of 170 security professionals was taken at RSA 2017, the world’s largest security conference. GDPR protects the privacy of European citizens and applies to all businesses that hold and process personal data collected in the European Union, regardless of their…
Security researchers identified a new variant of the Geodo/Emotet banking malware which has been targeting people in the UK. The campaign recorded appeared to peak on 18 April 2017 and primarily targeted email addresses associated with the .UK domain. The subject line of the emails sent varied slightly but the content took the form of fake billing notification emails, using an abnormally high billing amount to drive customers to click the link. Similar to previously recorded Geodo campaigns, these emails were formatted using images hosted by legitimate operator websites. Robert Capps, VP of business development at NuData Security commented below. Robert Capps,…
Verizon’s Data Breach Investigations Report (DBIR) highlights pretexting, or an attacker impersonating a CEO or CFO or corporate bigwig by spoofing and email to try and get information from employees. For example, the boss might send you an email asking you to help them transfer money or request information about how to do that from the company. IT security experts from FireMon, Prevalent, Inc. and Palo Alto Networks commented below. Paul Calatayud, CTO of Intelligent Security Management Firm at FireMon: “Pretexting is a very big threat that will continue to grow because it takes advantage of urgency and common cultural situations where employees…
Following the DBIR Verizon report, Ransomware [using technology to extort money from victims] saw a 50% rise from 2016, and a huge jump from the 2014 DBIR where it ranked 22 in the types of malware used, to 5th place this year. SCADA devices are not immune as an expert has shown that ransomware attacks, dubbed ‘Scythe,’ can infect firmware and disrupt regular processes. Proof of Concept ransomware has also be designed that targets Industrial Control Systems (ICS) by focusing on programmable logic controllers, critical for operations. Edgard Capdevielle, CEO at Nozomi Networks commented below. Edgard Capdevielle, CEO at Nozomi Networks: “Historically, SCADA systems…
Facebook and Google were the victims of a $100M phishing scam. According to the Justice Department, the crook forged email addresses, invoices, and corporate stamps in order to impersonate a large Asian-based manufacturer with whom the tech firms regularly did business. The point was to trick companies into paying for computer supplies. IT security experts from AlienVault, ESET, Tripwire, Comparitech.com and FireMon commented below. Javvad Malik, Security Advocate at AlienVault: “CEO / CFO fraud, is where a CFO being sent a phishing email purporting to be from the CEO demanding they immediately transfer some money to a third party. The…
Across any organization, data is stored on file servers throughout the network. The access to this data is likely unstructured and may constitute a risk to the organization. Because managing just who may have access to this unstructured data is virtually impossible, making complying with information audits a challenge. There are ways to brings order to this chaos and maintain an audit trail, making all access permissions visible, and obtaining recommendations about how to structure the unstructured data logically. Enterprise resource authorization manager (ERAM) technology can maintain an audit trail of all the actions in the network. For example, users…
Following the News that the zero-day flaw, which was recently discovered to affect all supported versions of Microsoft Word, was known to Microsoft while attacks were taking place. Darren Meyer, Senior Security Researcher, application security, Veracode commented below. Darren Meyer, Senior Security Researcher, Application Security at Veracode: “Veracode has long been a proponent of responsible disclosure of discovered flaws, and this is a pretty good example of that thought process in play. “Disclosing a vulnerability publicly before there is a patch carries some risk – you’re giving away potentially dangerous information that people could use to cause harm. Not disclosing also…
Anyone would think zero-day attacks are unpreventable following a recent claim from one leading cyber-security vendor. FireEye this year claimed to have discovered “29 of the last 53 zero-day attacks”. 24 exploits remained undetected, yet this was still presented as some kind of monumental achievement. Such a statement leaves little comfort for the businesses who found themselves victims, so is it time to just give up completely and let the cyber criminals take over? It certainly feels that way, even while threats intensify and Locky ransomware rears its ugly head in new forms with renewed malevolence. Although businesses are finally…
Barracuda identifies new tax return scam Tax season is coming to an end, but tax-related scams are not slowing down. In fact, sometimes tax fraud can be even more successful after tax day. The Barracuda Email Threat Scanner scans and analyses thousands of corporate mailboxes daily across the world, giving us a view into targeted phishing attacks. As companies and individuals rushed to meet the tax return deadline, we saw a significant number of threats go above and beyond the typical seasonal spam we’d expect. We identified one particular attack that was extremely well targeted and sophisticated. Hackers used multiple…